Written by: Wu Says Blockchain

In the era where AI synthesizes reality, what needs to be verified is no longer a specific piece of information, but the environment itself.

In the first half of 2026, there were a total of 182 publicly reported security incidents in the crypto industry, resulting in losses of approximately $956 million. More concerning than the total amount lost is the direction of the funds: according to SlowMist statistics, only 18 incidents in the first half managed to recover or freeze the stolen funds, totaling about $118 million, which accounted for 12.3% of the total losses, while nearly 90% of the stolen funds are irretrievable.

Another number can easily be misinterpreted: the $956 million loss was nearly 60% lower than the same period last year, but this does not mean the industry has become safer. The drop in losses was almost entirely due to last year's single significant incident involving Bybit (approximately $1.5 billion) not being repeated; the number of incidents actually rose by about 50% year-over-year. The attacks have not diminished but rather changed direction—from targeting protocol contracts to targeting individuals.

The two incidents with the highest losses in the first half did not breach smart contracts: Drift Protocol lost about $285 million due to a six-month-long social engineering infiltration that began with a few "unremarkable" transactions signed by a multi-signature signer; a victim in Singapore was invited to a government meeting that was entirely generated by AI, resulting in a loss of about 4.9 million Singapore dollars. The most expensive vulnerabilities appear to be human-related.

This is one of the core findings of the "2026 OKX Web3 Security Half-Year Report" jointly released by the OKX Web3 Security Team, SlowMist, and OtterSec, which shares common conclusions with SlowMist's concurrently released "2026 Half-Year Blockchain Security and Anti-Money Laundering Report." The two reports, originating from a trading platform and a security company, respectively, point to the same judgment: the frequency of attacks is rising, techniques are evolving, and targets are shifting from "code" to "people."

Year-over-year losses decreased by nearly 60%, while attack activities increased

The same set of data, when segmented in different ways, can yield contradictory conclusions, which is a prerequisite for understanding the security dynamics of the past six months.

According to statistics cited in the OKX report referencing SlowMist's database of breaches, there were 182 incidents in the first half, with losses amounting to approximately $956 million; during the same period in 2025, there were 121 incidents with losses of about $2.373 billion. The number of incidents has increased by approximately 50% year-over-year, while the monetary value has decreased by about 60%. The primary reason for the reduction in monetary losses was that the Bybit incident in February 2025 (approximately $1.5 billion, where hackers compromised the developer's computer of the signature tool Safe{Wallet} and tampered with the official website script) is an extreme case. The OKX report concludes that, excluding this anomaly, the comparable losses this year have actually increased.

The OKX report further breaks this half-year's changes into two account measures by cause of attack: by the number of incidents, contract and logical vulnerabilities remain the leading cause, totaling 85 incidents; however, by the amount of losses, supply chain attacks topped the list at approximately $298 million, followed by contract vulnerabilities (about $152 million) and private key leaks (approximately $130 million). SlowMist summarizes this characteristic with eight characters: "events are decentralized, losses are centralized." Among them, the truly deadly large losses are concentrated in critical areas such as infrastructure, cross-chain, and supply chain. A telling imbalance is that there were only 20 cross-chain bridge incidents in the entire half year, but they resulted in losses of approximately $346 million.

Funds are no longer primarily leaking from contract vulnerabilities. The OKX report summarizes the changes of this half year into three main threads: large losses are increasingly occurring outside contracts; regular users have become the primary targets of attacks; AI Agents have transitioned from tools to prey. In addition, there are two continuing threads: supply chain poisoning infiltrating the development process, and the money laundering downstream where all stolen funds eventually converge. Below are detailed discussions of each.

Project parties: the largest losses occur in areas not covered by audits

In the first half, the projects with the most severe losses were mostly not unaudited, with the breaches occurring precisely in areas outside the audit scope: signature processes, cloud keys, validation nodes, and developer devices. Audits can verify that contract logic is correct but cannot prove that these operational procedures are secure.

KelpDAO: it was the verification path that was compromised, not the contract. This was the largest single loss of the first half. According to OtterSec's review, the attackers polluted LayerZero's internal RPC nodes while simultaneously launching DDoS attacks against honest external nodes. Cross-chain messages were meant to be verified by multiple independent nodes, but at that time, the bridge used a "1-of-1" single verification node configuration. The only verification point received only forged data, ultimately permitting a withdrawal that had no real asset backing, resulting in approximately 116,500 rsETH being transferred out, of which about $75 million was frozen afterward. Single verification nodes have long been regarded as high-risk configurations, previously only a theoretical caution in architectural reviews; following the KelpDAO incident, it became a real loss of close to $300 million. SlowMist additionally traced the path of the stolen funds: LayerZero attributed the incident to the Lazarus subgroup TraderTraitor, with the stolen tokens subsequently used as collateral to borrow approximately $236 million in real assets (WETH) from lending platforms such as Aave, which once triggered a liquidity crisis in the DeFi market.

Drift: a six-month-long signature inducement. The mechanism deserves explanation: a durable nonce is equivalent to a "pre-signed transaction receipt that can be redeemed at any time in the future." Attackers, posing as a disguised quantitative institution with over $1 million in real deposits, cultivated trust over six months, inducing signers to pre-sign such management transactions. At the time of signing, no impact was evident; when the project party later adjusted the multi-signature threshold and a window lacking timelock (time lock: sensitive operations require public notice and delay to take effect) protection emerged, the attackers broadcast the pre-obtained signed transactions, completing 31 withdrawals in 12 minutes, taking away more than half of the locked assets. The core lesson of this incident is that signing a transaction that appears "uninfluential" at the moment does not mean it won't be executed in the future; blind signing, pre-signing, and indeterminate management transactions should all be considered high-risk operations.

A collective image of point-of-failure vulnerabilities. Resolv Labs’ AWS cloud key was stolen, enabling attackers to mint approximately 80 million unbacked tokens; Step Finance was compromised via an executive's device, and private keys were used to empty the treasury; Humanity Protocol suffered malware infection on developer devices, with private keys going out of control. SlowMist mentioned that chain analyst ZachXBT tracked and discovered that the stolen funds had mixing behavior with KelpDAO's stolen funds, effectively ruling out the potential for internal wrongdoing, again pointing to Lazarus.

The SlowMist report also documents a series of more underlying cases that bring attacks down to the level of cryptographic engineering implementations. The commonality of these three incidents is that the vulnerabilities were not within the conventional coverage of code audits.

• Taiko (June 22, approximately $1.7 million): A signing private key was mistakenly submitted to a public GitHub repository, allowing attackers to forge layer-two network state proofs, resulting in fund releases; the TAIKO token dropped over 20% shortly afterward.

• SecondFi / Formerly Yoroi (June 21-23, approximately $2.4 million): The signing algorithm implementation lacked a necessary random masking step, allowing complete private keys to be derived from a single on-chain signature, resulting in the theft of 374 addresses. The flaw stemmed from an unreviewed third-party component introduced two weeks prior to the incident.

• THORChain (May 15, approximately $10.7 million): The treasury's private key was co-managed by multiple nodes (threshold signature), intended so that no single node would hold the complete private key; however, a malicious node gradually collected key fragments during multiple rounds of normal signing processes, ultimately reconstructing the full private key.

From cross-chain validation, cloud keys to signing algorithms, these cases present different forms of the same failure: as long as there is one node in the critical path that can independently decide the direction of funds, it will become the primary target for attackers.

Based on the same judgment, OKX has implemented safeguards in signature risk control not only to verify "whether the transaction was initiated by the person" but rather to focus on ensuring that users understand the consequences of transactions before signing. Regarding high-risk scenarios such as durable nonces and account ownership changes, OKX intercepted or alerted regarding over 4 million high-risk operations in the first half, protecting a total amount of about $526 million, and has analyzed over 50,000 on-chain methods, translating incomprehensible calldata into "which assets this transaction will alter, what permissions it will grant." It should be noted that such capabilities only reduce rather than eliminate risks, and trading platforms and wallet service providers themselves are the highest-value targets for attacks; the 2025 Bybit incident was indeed due to the compromise of the signing tool, and neither party can claim immunity.

On the user side: Attacks begin at the most familiar entry points

As the costs of attacking protocols rise, attackers have turned to users. According to the OKX report, current attack entry points often occur in scenarios where users are the least vigilant: app stores, top search results, friend accounts, meeting software, recruitment processes.

• Malicious browser extensions use the "local shell, cloud poisoning" model: the extension itself does not contain malicious logic, so it can pass the static review of the app store; the actual phishing page is delivered in real-time by remote servers and can change domain names at any time (SlowMist captured a similar extension impersonating TronLink in May). Once users enter their mnemonic on such pages, control over their assets is transferred.

• Search ad poisoning is closer to everyday operations. In a case documented by the OKX report, a user searched for development tools after purchasing a new computer, clicked the paid ad at the top of the search results, and executed a line of "installation commands" as prompted by the page, which actually deployed a clipboard-hijacking trojan; later, when this user attempted to transfer about $20,000, the receiving address was automatically replaced. The difficulty in defending against such attacks lies in the fact that the victim has only conducted standard operations such as "searching for the official website, downloading tools, copying commands" throughout the process.

• Recruitment interview scams follow the path of "reconnaissance—profiling—targeted strikes": attackers pose as technical interviewers, requiring candidates to share screens, open wallets to "confirm DeFi experience," while actually recording their wallet addresses, holdings, and commonly used protocols; thereafter, they fabricate airdrop pages targeting the protocols the victims have genuinely used, sending tailored phishing messages. In a case documented by the OKX report, the victim lost approximately $88,000.

Two other categories of new techniques are worth noting. One is fake "2FA security verification": attackers send emails under the guise of the wallet's official name, using an impersonated domain name that differs by just one character, along with a countdown to create a sense of urgency, luring users to input their mnemonics to "complete verification." The other is business process fraud: using bait such as "external audits" or "token ownership confirmation" to deliver malicious attachments (one sample analyzed by SlowMist disguised a script as a document using a double extension), which, when opened, pretended to be a system update to steal passwords and then requested permissions for camera, screen recording, and keyboard monitoring, with final goals often being office terminals and cloud service permissions rather than personal wallets.

For the former, both reports provide a consistent bottom line warning:

Any page requesting mnemonics for verification, authentication, recovery, or upgrade is a scam. Mnemonics are not verification codes but the very control of assets; no legitimate wallet would request mnemonics via a webpage.

Since a significant amount of losses does not commence with on-chain transactions but rather starts much earlier with malicious applications or phishing websites, OKX has moved its defenses upstream to devices and access points: its security scanning assistant has completed over 200,000 risk assessments, discovering more than 60,000 high-risk applications; with respect to phishing websites and malicious DApps, over 7 million risky website visits have been intercepted, striving to intercept before users input their mnemonics and connect their wallets.

Moreover, a considerable amount of risk has already been embedded upstream—specifically in the software supply chain—before attackers contact users.

Supply chain: it is not the software package that is poisoned, but the trust itself

The peculiarity of supply chain poisoning lies in the fact that victims have made no errors but have simply installed a dependency, updated a version, or visited an official domain as usual. This is the most highlighted chapter in the SlowMist report, with three representative cases reflecting the evolution of such attacks in breadth, depth, and height.

• Breadth: Shai-Hulud worm. In mid-May, an account published 637 malicious versions involving 317 package names within 22 minutes, affecting popular components like echarts-for-react (with over 3.8 million downloads per month) and size-sensor (with over 4.2 million downloads per month). The malicious packages triggered confused payloads during installation, systematically collecting sensitive information such as AWS, GCP, Azure cloud credentials, Kubernetes cluster keys, SSH private keys, and encrypting them for exfiltration, while also providing a self-propagating module for worm-like dissemination, and was pre-equipped with persistence mechanisms targeting Claude Code and VS Code. The targets for theft were no longer single software packages but the permissions for entire development pipelines.

• Depth: Layered transmission of trust. In March, the Python library LiteLLM, with 97 million downloads per month, was attacked. The attackers did not directly invade the library but first contaminated the security scanning tool Trivy relied upon during its build process, thereby stealing the release key and pushing malicious versions. Developers trusted LiteLLM, LiteLLM trusted Trivy, and since Trivy was compromised, the security tool that should have borne the protective responsibility became part of the attack chain. In March, SlowMist also detected a poisoning of the official CDN of Apifox: attackers tampered with official scripts and embedded malicious code with random timers, causing them to activate between half an hour to three hours after installation, making it difficult for users to associate the abnormalities with particular actions. This indicates that "official sources" can no longer be fully equated with "security."

• Height: Attackers' "attack surface thinking." SlowMist's Chief Information Security Officer 23pds warned in April: the Lazarus subgroup HexagonalRodent was luring developers by offering high-paying remote job positions, enticing them to run code containing backdoors. According to the OKX report, this organization heavily relies on ChatGPT and Cursor to generate code and dialogues to create fake company websites and executive identities, and even uses AI to conduct "self-checks" on their malicious code to evade detection; in just one quarter, they stole wallet data from over 2,700 developer systems. Meanwhile, the AI-generated code itself is also creating new risk surfaces; the OKX report cites OtterSec data: Georgia Tech attributed 35 out of the 74 CVEs in March to AI-generated code, and a scan of about 1,400 "freely generated" applications discovered 2,038 serious vulnerabilities and over 400 exposed keys. "Functionality is available" does not equate to "production-ready."

Similar incidents include the sudden appearance of anomalous versions of node-ipc after 21 months of no updates, and TrapDoor, which spanned three major ecosystems for cooperative poisoning. They collectively point to one conclusion: the past emphasis of defenses was on auditing code; today, it must be on auditing the sources of trust. This is particularly critical for the Agent ecosystem, which actively reads, installs, and executes external plugins. Accordingly, OKX has established access reviews and regular inspections covering code security, permission scopes, and external dependencies in the plugin access of Agentic Wallet, moving the judgment of "whether dependencies are trustworthy" before plugins go live.

AI: from forging single content to synthesizing entire environments

Linking the previous contents together, a hidden main line can be seen: there is a natural trust from the outside toward "smarter systems." The next collective misjudgment forming is that Agents are more reliable than humans. This cognition has not yet been corrected by sufficient incidents, but the costs have already manifested.

The Bankr incident in May is a case that almost does not resemble an "invasion": the attackers did not steal private keys, did not attack contracts, did not invade servers, but simply asked Grok to translate a segment of Morse code. BankrBot, an AI Agent deployed on the X platform, can automatically execute on-chain transactions based on natural language commands. According to SlowMist's review, the attackers first airdropped a membership NFT to a related wallet, triggering its high privilege mode, then sent a Morse code message asking Grok to translate; once Grok completed decoding, it @BankrBot with the hidden transfer instruction (about 3 billion DRB tokens), which BankrBot regarded as a trusted instruction and executed directly. Losses amounted to about $150,000 to $200,000 (SlowMist recorded about $175,000), and approximately 80% was recoverable afterward. Neither Grok nor BankrBot had traditional vulnerabilities; the real failure was the unverified trust boundary between the two automated systems. When an Agent possesses the ability to sign and transfer, a malicious instruction disguised as normal input can translate into actual asset losses.

SlowMist categorizes attacks on Agents into four layers based on their cognitive to execution chains, with real cases corresponding to each layer:

• Input layer: Indirect prompt injection. Injecting malicious instructions into external content actively read by Agent, as seen in the Bankr incident.

• Memory layer: Memory pollution. Validation by Palo Alto Networks Unit 42 indicates that malicious rules can be written into an Agent's long-term memory (e.g., marking the attacker's address as a "frequent payment address") and remain effective in subsequent sessions.

• Tool layer: Permission penetration. In the OpenClaw "Claw Chain" incident disclosed in May, security company Cyera discovered four exploitable vulnerabilities (with the highest severity rating of CVSS 9.6) that could be chained together for complete control of the execution environment.

• Supply chain layer: OpenClaw plugin center lacks audits; malicious skills masquerade as functional documentation, hiding commands in code, and adopting a "two-phase" approach to dynamically pull the true malicious payload from remote sources.

AI fundamentally alters phishing scenarios by upgrading fraud from "forging single content" to operating a whole set of "synthesized realities." According to the OKX report referencing Check Point’s disclosure of Operation "Truman Show," attackers lure victims into a private investment group where "experts" and "investors" are all played by AI, continuously issuing analyses, showcasing gains, and interacting in real-time; victims face not just a single scammer but a fabricated environment with a complete social and trust structure. The case of the AI-generated video conference in Singapore mentioned at the beginning of this article (with generated representatives from the Prime Minister, President, and Monetary Authority all present, resulting in a loss of approximately 4.9 million Singapore dollars) is an extreme embodiment of the same tactic.

As a result, the targets of attacks have undergone a fundamental shift: what needs to be deceived is no longer the user's judgment on a single piece of information but rather their understanding of the authenticity of the overall environment. The judgment that "vulnerabilities appear in people" should also be further extended; when machines begin to replace people in making judgments, the risk boundaries expand from "people" to all segments that are implicitly trusted, including the trust boundaries between machines. Traditional defenses based on "identifying suspicious information" are becoming ineffective.

In addressing this, the industry has reached a consensus: Agents can organize transactions more intelligently, but their execution processes must be subject to stricter constraints. SlowMist embeds security capabilities into the operational processes of Agents; its MistEye Security Gate provides "pre-detection, post-execution" hard blocking mechanisms for coding agents such as Claude Code and Cursor, while MistTrack Skills, leveraging over 400 million on-chain address labels covering 19 mainstream public chains, completes anti-money-laundering risk screenings before transfers. OKX’s approach is similarly not to rely entirely on the judgments of Agents for security: regardless of how transactions are generated, an independent risk assessment will be conducted prior to signing and broadcasting, and if risks are identified, a second confirmation or direct interception will be required.

Sixth, fund flows: only about 12% recoverable, money laundering has become highly industrialized

Returning to the numbers mentioned at the beginning. The AML and regulatory data in this chapter mainly comes from SlowMist's tracking: in the first half, only 18 incidents allowed for fund recovery or freezing, involving approximately $389 million stolen, with about $118 million recoverable or frozen, accounting for 12.3% of the total losses. The vast majority of stolen funds become difficult to recover once transferred out, primarily due to the highly industrialized laundering segments that follow.

Taking Lazarus as an example, its laundering chain is tightly interlinked: first, it cuts off on-chain associations through privacy protocols like Umbra, then exchanges the funds into bitcoin through name-free cross-chain protocols like THORChain (which is liquid and easy to split), spreading the funds across thousands of new addresses, processing them via mixing services like Sinbad, YoMix, and Wasabi, and finally converting them offshore into fiat currency through Chinese OTC counters or networks of Russian exchanges (such as Garantex and its successor Grinex). If the stolen assets are tokens like rsETH, they would first be collateralized in DeFi protocols for real asset borrowing, and the funds stolen from KelpDAO followed this path. Once funds enter cross-chain and mixing segments, the window for recovery essentially closes.

The inflow of funds into privacy protocols indirectly confirms this: according to SlowMist's statistics based on Dune, major privacy protocols accumulated inflows of about $974 million in the first half, with Tornado Cash accounting for approximately 71%, and Railgun for about 23%, with nearly 90% of their inflows being stablecoins. The other end of the dark industry reflects the "servicification" of tools: within the Drain-as-a-Service platforms tracked by SlowMist, the Rublevka Team has stolen over $10 million since 2023, completing at least 240,000 successful thefts while offering up to 80% profit shares to affiliates; StepDrainer has designated a price for the entire fishing toolset, with complete source code priced at about $750. The barrier to acquiring attack tools has dropped to an extremely low level.

Regulatory constraints are also tightening and starting to target key nodes in money laundering channels more precisely. In the dynamics organized by SlowMist, the three most directly affecting the above links are: the EU's 20th round of sanctions prohibits trading with Russian crypto service providers for the first time, directly targeting outflow channels like Garantex and Grinex; Dubai's DIFC has completely banned privacy coin trading, targeting the mixing segment; and in February, eight departments in China issued new regulations clearly stating that stablecoins pegged to the yuan cannot be issued abroad without approval. Other measures also advance in the same direction, with Hong Kong issuing the first licenses for stablecoin issuers, South Korea planning fines for exchanges attacked by hackers amounting to up to 10% of the stolen amount, and the U.S. launching the first set of stablecoin regulations under the GENIUS Act. The starting point of money laundering links is often a malicious address or a high-risk authorization, and the OKX report emphasizes that its KYS risk capabilities will continuously identify abnormal addresses, malicious tokens, and high-risk authorizations, striving to mark risks before funds enter mixing and cross-chain channels.

Seventh, conclusion: moving the defense line up to before confirmation

At the moment the signer on Drift presses the confirm button, all defenses lose their meaning. Most lessons learned in the first half of 2026 occurred before the action of "confirmation": someone signed transactions they did not understand, systems granted excessive permissions, teams trusted incorrect data sources, and users believed in a sufficiently convincing disguise.

Whether through OKX's proposals of "understanding before signing, preventing single point risks, verifying before trusting," or the overarching theme of SlowMist's report of "verifying before trusting," they ultimately point in the same direction: moving judgment to before actions occur. Accordingly, this can be summarized into three lists.

For project parties: Key transactions should not confirm "who signed," but also confirm "whether the signer understands the consequences." Operations like multi-signatures, contract upgrades, owner changes, and cross-chain configurations should have processes that are understandable, simulatable, and verifiable; large fund outflows and permission changes should set time locks and abnormal alerts. No single segment should decide the direction of funds independently, whether it be a single RPC, a verification node, a cloud key, or an administrator address. Dependency scanning should be integrated into routine processes; requests involving funds, permissions, and deployments should not be confirmed through only one channel; video conferences and friend accounts do not constitute proof of identity.

For ordinary users: Transactions that are not understood should not be signed. Large assets and regularly used wallets should be stored separately, infrequently used authorizations should be routinely revoked, and operations involving unlimited authorization, Permit/Permit2 should be approached with particular caution; most attacks do not immediately transfer assets, but first acquire authorization and then wait for the right moment to act. Any page requesting mnemonics is a scam; any request for remote control, screen sharing, installing unfamiliar meeting software, or executing terminal commands should be verified beforehand.

For Agent users and developers: Input filtering, tool call sandboxes, permission levels, double confirmations for sensitive operations, and validation before execution are basic configurations for any Agent that can hold funds, not optional features. System prompts should not be treated as security control measures; Agents should be responsible for generating solutions, while an immutable rule system should be responsible for authorizations.

The first half of 2026 did not represent an overall improvement in security conditions but rather a systematic shift in the paradigm of attacks, transitioning from contract code to people, infrastructure, and trust itself. In the era where synthetic reality has become possible, what needs to be verified is no longer a specific piece of information, but the environment itself. The goal of security has never been to require every participant to become an expert but to intercept risks before confirmation at the points where they are most likely to err.

The most needed repairs in the first half of 2026 are not for a specific contract but for people and the processes themselves.